Third-party notices

Byhand is built on open-source software. This file lists every library and data file the site ships and the licence each one uses. The licence audit (scripts/license-audit.mjs) fails if an unreviewed AGPL/GPL dependency is added; the reviewed exceptions are listed under "Copyleft" below.

Large binaries (WebAssembly engines, models, fonts, language data) are downloaded once at build time from a pinned version, checked against a sha256, and served from Byhand's own /wasm/ folder. None of them is fetched from another host when the site runs.

Copyleft (recorded, permitted for a web service)

@ffmpeg/core and @ffmpeg/core-mt (ffmpeg.wasm cores, single- and multi-thread): GPL-2.0-or-later (NOT LGPL: the published cores are built with libx264, which makes the whole binary GPL). FFmpeg compiled to WASM. The multi-thread core runs on the cross-origin-isolated video and audio pages, the single-thread core everywhere else. Loaded at runtime as a separate, unmodified program from /wasm/ inside a Web Worker and driven through its command-line interface; Byhand's own code is not linked into either. Byhand's MIT class worker (src/workers/ffmpeg/) mounts files through the core's Emscripten FS API (WORKERFS and an OPFS adapter), the same interface ffmpeg.wasm's own MIT worker uses. Both core binaries are unmodified. Complete corresponding source: ffmpeg.wasm, tag v0.12.10 and ffmpeg.org. If a GPL component is unacceptable, replace it with a self-built LGPL core (configure FFmpeg without --enable-gpl/libx264; H.264 encoding then becomes unavailable and Compress Video must output VP9/WebM).
heic-to (bundles libheif + libde265): LGPL-3.0. HEIC decoding. Runtime-loaded WASM module. Source: github.com/hoppergee/heic-to.
libraw-wasm (bundles LibRaw 0.22.1): ISC (wrapper) / LibRaw: CDDL-1.0 (dual LGPL-2.1 or CDDL-1.0; CDDL elected) / Little CMS 2.19.1: MIT / libjpeg: IJG / zlib: Zlib / libpng: libpng. RAW development for RAW to JPG/PNG. Unmodified libraw.wasm + libraw.js loaded at runtime from /wasm/libraw/ in a Web Worker; not linked into Byhand code. Source: LibRaw 0.22.1 and LibRaw-Wasm v1.6.0. This software is based in part on the work of the Independent JPEG Group. Full notice: /wasm/libraw/NOTICE.txt.

CDDL-1.0 is a file-level licence (the same class as MPL-2.0): it covers the LibRaw files themselves, which ship unmodified, and places no terms on the rest of the site.

Not used, by policy

MuPDF / mupdf.js, PyMuPDF and Ghostscript are AGPL-3.0 (Artifex dual license). They are excluded; PDF compression and encryption use QPDF instead.

Also turned down for their licences: potrace, esm-potrace-wasm, dcraw and archive-wasm (GPL), 7z-wasm (LGPL plus the unRAR restriction), node-unrar-js (unRAR licence), jszip (MIT or GPL-3.0 dual licence), libimagequant and pngquant (GPL), mathml2omml (LGPL-3.0), the UltraSharp upscaling weights (CC-BY-NC), the SCRFD and RetinaFace face detectors (non-commercial), and Llama, Gemma, LFM and Qwen2.5-3B models (custom licences).

Permissive

Framework and site

astro, @astrojs/*: MIT. Framework.
preact, @nanostores/preact, nanostores: MIT. Islands + state.
tailwindcss, @tailwindcss/vite: MIT. Styling.
vite-plugin-pwa, @vite-pwa/astro, workbox-*: MIT. Service worker.
geist (Geist Sans / Mono): SIL OFL 1.1. Typography.
arctic: MIT. Google / Apple OAuth client.
@supabase/supabase-js: MIT. Optional Supabase sign-in hop.
stripe: MIT. Billing.

File, media and document tools

pdf-lib: MIT. PDF merge/split/rotate/watermark/page numbers/JPG→PDF, and the PDF writer behind Word, EPUB and PDF/A output.
@pdf-lib/fontkit: MIT (+ pako: MIT AND Zlib). Font parsing and subsetting for Word to PDF, EPUB to PDF and PDF to PDF/A.
pdfjs-dist (pdf.js): Apache-2.0. PDF rendering, text extraction, previews, PDF to EPUB structure.
@neslinesli93/qpdf-wasm: ISC (wrapper) / QPDF: Apache-2.0. PDF compress, encrypt, decrypt.
fflate: MIT. Reading the ZIP containers of DOCX and EPUB files, and writing EPUB.
linebreak: MIT (+ unicode-trie, base64-js, tiny-inflate: MIT; pako: MIT AND Zlib). Unicode line breaking for the document layout engine.
rtf.js: MIT (+ codepage: Apache-2.0). EMF and WMF drawings in Word documents (its EMFJS/WMFJS bundles only).
@jsquash/jpeg (MozJPEG): Apache-2.0 / BSD-3 (MozJPEG). JPEG codec.
@jsquash/png, @jsquash/oxipng: Apache-2.0 / MIT (Oxipng). PNG codec + optimiser.
@jsquash/webp (libwebp): Apache-2.0 / BSD-3 (libwebp). WebP codec.
@jsquash/avif (libavif, dav1d, aom): Apache-2.0 / BSD-2. AVIF codec.
@jsquash/resize: Apache-2.0 / MIT. Lanczos resize.
image-q: MIT (includes NeuQuant © 1994 Anthony Dekker, permissive notice; RgbQuant.js MIT). PNG palette quantization for target sizes.
@visioncortex/vtracer: MIT OR Apache-2.0. PNG/JPG → SVG tracing (wasm). JS glue adapted to ESM in src/lib/tools/image/vectorize/vtracer-glue.js.
pica: MIT. Lanczos upscaling (Classic mode).
onnxruntime-web 1.29: MIT. Runs the background-removal, upscaling and face-detection models (WebGPU or WebAssembly).
@ffmpeg/ffmpeg, @ffmpeg/util: MIT. ffmpeg.wasm JS wrapper.
tesseract.js, tesseract.js-core: Apache-2.0. OCR (worker, engine and language data self-hosted under /wasm/tesseract).
@zip.js/zip.js: BSD-3-Clause, Copyright (c) 2023 Gildas Lormeau (its zip-module.wasm is zlib: Zlib). Extract Archive (ZIP, including AES) and Create ZIP. Served unmodified as /wasm/archive/zip-web-worker.js and /wasm/archive/zip-module.wasm; licence text: /wasm/archive/NOTICE.txt.
client-zip: MIT. ZIP downloads.
signature_pad: MIT. Drawn signatures for Sign PDF.
qrcode: MIT. QR code generation.
bwip-js: MIT. Barcode generation (Code 128/39, EAN, UPC, ITF-14, Data Matrix, PDF417).
mammoth: BSD-2-Clause. DOCX text extraction for the AI tools.
docx: MIT. DOCX generation.
prettier: MIT. Code beautifier.
marked: MIT. Markdown rendering.
dompurify: Apache-2.0 / MPL-2.0. HTML sanitising.

Speech and Basic AI

@huggingface/transformers: Apache-2.0. Speech recognition (Whisper) and Basic mode text generation, in a Web Worker.
@huggingface/jinja: MIT. Chat templates for Basic mode.
@huggingface/tokenizers: Apache-2.0. Tokenizers for Whisper and Granite.
onnxruntime-web 1.31.0-dev.20260914-8d85527a0 (nested under transformers): MIT. Runtime for the speech and Basic models; its wasm files are self-hosted under /wasm/ml/ort/.

Server (Pages Functions only; never sent to the page)

@anthropic-ai/sdk: MIT (+ standardwebhooks: MIT; fast-sha256: Unlicense; @stablelib/base64: MIT; json-schema-to-ts: MIT; @babel/runtime: MIT; ts-algebra: MIT). The Pro AI tools' model gateway.

Vendored builds

byhand-libarchive (vendor/libarchive-wasm): BSD-2-Clause AND Zlib AND bzip2-1.0.6 AND 0BSD AND BSD-3-Clause. Byhand's own WebAssembly build of libarchive 3.8.9 (BSD-2-Clause; a few files carry a 3-clause UC Regents notice, one is public domain, and the bundled BLAKE2 code is CC0-1.0 / OpenSSL / Apache-2.0) with zlib 1.3.2 (Zlib), bzip2 1.0.8 (bzip2-1.0.6), liblzma 5.8.4 (0BSD) and zstd 1.5.7 (BSD-3-Clause, decompression only), compiled with Emscripten 6.0.10. It opens 7Z, RAR, TAR, GZ, BZ2, XZ, ZST, ISO, CAB and similar archives in Extract Archive. The C shim byhand_archive.c is BSD-2-Clause. Build script, pinned source hashes and every licence text: vendor/libarchive-wasm/ (README.txt, LICENSES/). Served as /wasm/archive/libarchive.wasm. Full notice, with the copyright lines and complete licence texts of libarchive, zlib, bzip2, liblzma, zstd and zip.js: /wasm/archive/NOTICE.txt.

Models

MODNet photographic portrait matting: Apache-2.0 (ZHKKKe/MODNet). Remove Background. public/wasm/models, downloaded at build with a pinned sha256.
Real-ESRGAN realesr-general-x4v3 and realesr-animevideov3: BSD-3-Clause, Copyright (c) 2021, Xintao Wang (full text below). AI mode in Upscale Image (photos; illustrations and anime). ONNX exports of the official Real-ESRGAN v0.2.5.0 .pth checkpoints; every weight tensor matches them byte for byte.
YuNet face_detection_yunet_2026may: MIT, Copyright (c) 2020 Shiqi Yu (full text below); trained on WIDER FACE. Face detection in Blur Faces. OpenCV Zoo, commit 47534e2.
Whisper base and small: MIT (github.com/openai/whisper) / Apache-2.0 (Hugging Face model card). Transcribe Audio, Video to Text & Subtitles, and recordings dropped into Meeting Minutes. ONNX conversions by onnx-community: whisper-base_timestamped @ 608c49e6, whisper-small_timestamped @ 65caa70f. The conversion repos declare base_model openai/whisper-base / whisper-small and no licence of their own. Full notice: /wasm/ml/NOTICE.txt.
IBM Granite-4.0-1B: Apache-2.0. Basic mode (free, no credits) in the Paraphrasing Tool, Grammar & Style Editor and Text Summarizer. onnx-community/granite-4.0-1b-ONNX-web @ b5b6a8c3, q4 (4-bit weights, fp32 activations), converted from ibm-granite/granite-4.0-1b; both repos declare Apache-2.0. Full notice: /wasm/ml/NOTICE.txt.

Model files over 20 MiB are stored as numbered parts with a .parts.json manifest and joined after download; the bytes are unchanged.

Fonts

Carlito (googlefonts/carlito @ 3a810ca): SIL OFL 1.1. Metric-compatible stand-in for Calibri.
Caladea (huertatipografica/Caladea @ 336a529): SIL OFL 1.1. Metric-compatible stand-in for Cambria.
Liberation Sans, Serif and Mono 2.1.5: SIL OFL 1.1 (Reserved Font Name "Liberation"). Stand-ins for Arial, Times New Roman and Courier New, and the fallback for Greek, Cyrillic and Hebrew.

These fonts are embedded as subsets in PDFs you create with Word to PDF, EPUB to PDF and PDF to PDF/A; the OFL permits this. The licence text ships with them at /wasm/fonts-docs/LICENSE-OFL.txt.

Data files

tessdata_fast 4.1.0 (tesseract-ocr/tessdata_fast): Apache-2.0. OCR language data: English plus 12 more languages (Spanish, French, German, Italian, Portuguese, Dutch, Polish, Turkish, Russian, Arabic, Chinese Simplified, Japanese), stored gzipped under /wasm/tesseract.
Compact-ICC-Profiles (saucecontrol, commit bdd84663): sRGB-v2-magic, sGrey-v4, CGATS001Compat-v2-micro: CC0-1.0. Colour profiles for PDF/A output intents, inlined in src/lib/docflow/icc.ts.
Name lists in src/lib/redact/data/: Public domain. Detecting person names in Redact Text and the AI tools' masking.

Name lists in src/lib/redact/data/ are derived from US Social Security Administration baby-name data (public domain; obtained via the CC0 babynames R package) and US Census Bureau 2010 surname data (public domain). Word statistics were computed from public-domain Project Gutenberg texts; no text from them is included.

Test fixtures (never shipped): the Apollo 11 crew portrait used by the face tests is a NASA photograph in the public domain.

Build-time and development only (not shipped)

satori: MPL-2.0 (its own dependencies, including a nested fflate 0.7.3, linebreak, yoga-layout and @shuding/opentype.js, are MIT). Renders the Open Graph images at build time.
@resvg/resvg-js: MPL-2.0. Turns those SVG cards into PNG files.
@fontsource/inter, @fontsource/jetbrains-mono: SIL OFL 1.1. Typefaces drawn into the Open Graph PNGs (the font files are not served).
tsx: MIT. Runs the golden-set evals (npm run evals).
fake-indexeddb: Apache-2.0. Unit tests.
sharp 0.35 (nested under @huggingface/transformers): Apache-2.0. Node only, never bundled. Its optional libvips binaries are LGPL-3.0; they may be installed on developer machines and are never shipped or served.
onnxruntime-node: MIT. Node only (install skipped with ONNXRUNTIME_NODE_INSTALL=skip).

Test and build tooling (Vitest, Playwright, axe-core, Lighthouse CI, Wrangler, TypeScript) is used only on developer machines and in CI. veraPDF and EPUBCheck are run by hand to validate PDF/A and EPUB output; they are not dependencies.

Real-ESRGAN licence

BSD 3-Clause License

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

YuNet licence

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.